The GDPR and the AI Act: the upcoming challenge of financial institutions
Risk servicesFebruary 2025 marks the beginning of the regulatory shift towards the implementation of the EU Artificial Intelligence Act, or the so-called AI Act.

Effective AML measures are essential for ensuring your legal and regulatory compliance, maintaining the integrity of financial systems, supporting economic stability, and protecting against the threats posed by organized crime and terrorism.
As regulators do not shy away from fining organisations for not having proper AML governance, regular AML audits can uncover inefficiencies in your AML processes, leading to improved procedures and cost savings. But maybe even more important, it demonstrates your proactive approach to AML which enhances the confidence of investors, customers, and regulators in your organisation's governance.
As (international) AML legislation continuously evolves, a key aspect of internal control is evaluating your organisation's AML policies and procedures to ensure they are comprehensive, up-to-date, and aligned with regulatory requirements. Our AML specialists are happy to help you with this.
AML compliance has become an extensive task for organisations and is, therefore, strongly dependent on the use of Regulatory Technology (RegTech).
Key processes like client onboarding, identification and verification, transaction monitoring, sanction screening, and reporting suspicious activities all depend on RegTech tooling. The implementation (and use by staff) of these tools must stay aligned with the continuously evolving legislation and your organisation's risk management.
So, whether your organisation is using RegTech or not, Internal Audit should continue playing a key role:
Please reach out if you need independent assurance or advice on AML governance and related risks. We are happy to help.
February 2025 marks the beginning of the regulatory shift towards the implementation of the EU Artificial Intelligence Act, or the so-called AI Act.
By 2 August 2027, every financial institution in Europe will have to comply with one of the most significant and wide-reaching AI regulations to date, becoming accountable not only for what their AI does but also for how it was built. Moreover, most of the requirements of the AI Act will already become applicable by 2 August 2026
In line with the Dutch National Bank (DNB) licensing requirements, your payment institution is required to have an internal audit function in place. A strong internal audit (IA) function is crucial to creating a structure for risk management, supporting compliance activities, and providing opportunities to improve business performance.